Distributed network address translation over network environments

Abstract

This disclosure describes techniques for implementing network address translation as a distributed service over the nodes of a logical network fabric, such as a software-defined network fabric. A method includes registering, by an edge node of a network, an IP address of a client device. The method further includes forwarding, by the edge node, the registered IP address to a control plane of the network. The method further includes checking, by the control plane, a network address translation policy. The method further includes recording, by the control plane, translations between the registered IP address and an allocated IP address in a translation table, each of the translations being related to the edge node. The method further includes returning, by the control plane, the translations between the registered IP address and the allocated IP address to the edge node.

What is claimed is: 
     
       1. A physical server disposed in an underlay of physical servers that execute a virtual network overlay, the physical server comprising:
 one or more processors; and 
 one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to: 
 establish, by a first edge node of the virtual network overlay, a connection to a client device having a device address; 
 send, by the first edge node, a first registration message to a control plane node of the virtual network overlay; 
 look up, by the control plane node, a network address translation (NAT) policy; 
 assign, by the control plane node, a subnet address to the client device as a NAT address based on the NAT policy; 
 record, by the control plane node, a first mapping and a second mapping between the device address and the assigned NAT address, each of the first mapping and the second mapping being associated with the first edge node; 
 send, by the control plane node, a confirmation message to the first edge node indicating the first mapping and the second mapping between the device address and the NAT address; 
 establish, by a second edge node of the virtual network overlay, a connection to the client device; 
 send, by the second edge node, a second registration message to the control plane node, the first registration message and the second registration message respectively comprising a same Endpoint ID (EID) of the client device; and 
 update, by the control plane node, each of the first mapping and the second mapping from being associated with the first edge node to being associated with the second edge node. 
 
     
     
       2. The physical server of  claim 1 , wherein the registration message is a Locator/ID Separator Protocol (LISP) registration request representing the edge node as an egress tunnel router (ETR) and the device address as an EID. 
     
     
       3. The physical server of  claim 1 , wherein the NAT policy specifies that NAT is applied to traffic between hosts addressed by private subnet addresses allocated to the virtual network overlay and hosts outside the network fabric. 
     
     
       4. The physical server of  claim 1 , wherein the NAT policy specifies that NAT is applied to traffic between hosts addressed by private subnet addresses of the network fabric and hosts outside the network fabric, and applied to traffic among hosts addressed by private subnet addresses of the network fabric. 
     
     
       5. The physical server of  claim 1 , wherein the NAT policy specifies that NAT is applied to traffic originating from subnet addresses not registered by LISP at the control plane node. 
     
     
       6. The physical server of  claim 1 , wherein the first mapping is a mapping from the device address as a key to the assigned NAT address, and the second mapping is a mapping from the assigned NAT address as a key to the device address. 
     
     
       7. The physical server of  claim 1 , wherein each of the first mapping and the second mapping is associated with the edge node. 
     
     
       8. A method comprising:
 executing a virtual network overlay on a physical server of an underlay of physical servers; 
 establishing, by a first edge node of the virtual network overlay, a connection to a client device having a device address; 
 sending, by the first edge node, a first registration message to a control plane node of the virtual network overlay; 
 looking up, by the control plane node, a NAT policy; 
 assigning, by the control plane node, a public subnet address to the client device as a NAT address based on the NAT policy; 
 recording, by the control plane node, a first mapping and a second mapping between the device address and the assigned NAT address, each of the first mapping and the second mapping being associated with the first edge node; 
 sending, by the control plane node, a confirmation message to the first edge node indicating the first mapping and the second mapping between the device address and the NAT address; 
 establishing, by a second edge node of the virtual network overlay, a connection to the client device; 
 sending, by the second edge node, a second registration message to the control plane node, the first registration message and the second registration message respectively comprising a same Endpoint ID (EID) of the client device; and 
 updating, by the control plane node, each of the first mapping and the second mapping from being associated with the first edge node to being associated with the second edge node. 
 
     
     
       9. The method of  claim 8 , wherein the registration message is a Locator/ID Separator Protocol (LISP) registration request representing the edge node as an egress tunnel router (ETR) and the device address as an EID. 
     
     
       10. The method of  claim 8 , wherein the NAT policy specifies that NAT is applied to traffic between hosts addressed by private subnet addresses allocated to the virtual network overlay and hosts outside the network fabric. 
     
     
       11. The method of  claim 8 , wherein the NAT policy specifies that NAT is applied to traffic between hosts addressed by private subnet addresses of the network fabric and hosts outside the network fabric, and applied to traffic among hosts addressed by private subnet addresses of the network fabric. 
     
     
       12. The method of  claim 8 , wherein the NAT policy specifies that NAT is applied to traffic originating from subnet addresses not registered by LISP at the control plane node. 
     
     
       13. The method of  claim 8 , wherein the first mapping is a mapping from the device address as a key to the assigned NAT address, and the second mapping is a mapping from the assigned NAT address as a key to the device address. 
     
     
       14. A system comprising:
 one or more processors; and 
 one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to: 
 establish, by a first edge node of the virtual network overlay, a connection to a client device having a device address; 
 send, by the first edge node, a first registration message to a control plane node of the virtual network overlay; 
 look up, by the control plane node, a network address translation (NAT) policy; 
 assign, by the control plane node, a public subnet address to the client device as a NAT address based on the NAT policy; 
 record, by the control plane node, a first mapping and a second mapping between the device address and the assigned NAT address, each of the first mapping and the second mapping being associated with the first edge node; 
 send, by the control plane node, a confirmation message to the first edge node indicating the first mapping and the second mapping between the device address and the NAT address; 
 establish, by a second edge node of the virtual network overlay, a connection to the client device; 
 send, by the second edge node, a second registration message to the control plane node, the first registration message and the second registration message respectively comprising a same Endpoint ID (EID) of the client device; and 
 update, by the control plane node, each of the first mapping and the second mapping from being associated with the first edge node to being associated with the second edge node. 
 
     
     
       15. The system of  claim 14 , wherein the registration message is a Locator/ID Separator Protocol (LISP) registration request representing the edge node as an egress tunnel router (ETR) and the device address as an EID. 
     
     
       16. The system of  claim 14 , wherein the NAT policy specifies that NAT is applied to traffic between hosts addressed by private subnet addresses allocated to the virtual network overlay and hosts outside the network fabric. 
     
     
       17. The system of  claim 14 , wherein the NAT policy specifies that NAT is applied to traffic between hosts addressed by private subnet addresses of the network fabric and hosts outside the network fabric, and applied to traffic among hosts addressed by private subnet addresses of the network fabric. 
     
     
       18. The system of  claim 14 , wherein the NAT policy specifies that NAT is applied to traffic originating from subnet addresses not registered by LISP at the control plane node. 
     
     
       19. The system of  claim 14 , wherein the first mapping is a mapping from the device address as a key to the assigned NAT address, and the second mapping is a mapping from the assigned NAT address as a key to the device address. 
     
     
       20. The system of  claim 14 , wherein each of the first mapping and the second mapping is associated with the edge node.